Slashdot Mirror

← Back to Stories (view on slashdot.org)

IE Download.Ject Exploit Fixed

Posted by simoniker on from the round-and-round dept.

Saint Aardvark writes "Just in time for the weekend, the Internet Storm Center is reporting that Microsoft is providing a fix for the Download.Ject vulnerability that hit IE late last month. The press statement says that it'll hit Windows Update later today..."

2 of 421 comments (clear)

  1. Re:FYI by Anonymous Coward · · Score: 5, Informative

    Nope:

    Critical Update for Microsoft Data Access Components - Disable ADODB.Stream object from Internet Explorer (KB870669)
    Adodb.stream provides a method for reading and writing files on a hard drive.

    Quick Info
    File Name:
    Windows-KB870669-x86-ENU.exe

    Download Size:
    104 KB

    Date Published:
    7/2/2004

    Version:
    870669

    Overview
    Adodb.stream provides a method for reading and writing files on a hard drive. This by-design functionality is sometimes used by web applications. However, when combined with known security vulnerabilities in Microsoft Internet Explorer, it could allow an internet web site to execute script from the Local Machine Zone (LMZ). This occurs because the ADODB.Stream object allows access to the hard drive when hosted within Internet Explorer.

    It has nothing to do with known threats.

  2. Microsoft released a fix a long time ago by Sheepdot · · Score: 5, Informative
    Ever wondered how IE exploits get a whole executable to your computer?

    Wonder no more. 11 months of IE exploits and at least a year or two's worth of future exploits can be avoided with one simple registry change. The problem that MS has isn't that they are incompetent, it's that they insist on leaving default features that are used by 1% of administrators like myself.

    98% of spyware released since January 2004 can be avoided with the above registry fix. If you think that statistic is outrageous, I challenge you to find one piece of malware installed without using ADODB.Stream in one way, shape, or form. Be forewarned, I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.